News for hackers. Stuff that matters.

A comment on Help:We Found a Bitcoin Mining Prog / Email Server Running on Our Server. Parent comment

Re:Help:We Found a Bitcoin Mining Prog / Email Server Runnin... by gopi_ar on Monday November 28, 2016 @07:38AM (#13054997)
Yes, it's a Redis vulnerability (caused by bad config on our part) in one container where the firewall was down.

Strange thing if we run 'top' from the main host, all containers running redis say 'statd' as their user; inside the container the user showed 'redis'. We removed nfs and all related files, and now it shows a user ID number. Is this something we should worry about?

[ Parent | on HN ]
Re:Help:We Found a Bitcoin Mining Prog / Email Server Runnin... by alexginzburg on Monday November 28, 2016 @09:05AM (#13055441)
Could you elaborate what redis configuration could've caused this?
[ Parent | on HN ]
Re:Help:We Found a Bitcoin Mining Prog / Email Server Runnin... by gopi_ar on Tuesday November 29, 2016 @12:44AM (#13061118)
Here you go: https://kevinchen.co/blog/postmortem-server-compromised/
[ Parent | on HN ]
Re:Help:We Found a Bitcoin Mining Prog / Email Server Runnin... by edifus on Monday November 28, 2016 @09:38AM (#13055613)
http://antirez.com/news/96
[ Parent | on HN ]
Re:Help:We Found a Bitcoin Mining Prog / Email Server Runnin... by eminkel on Tuesday November 29, 2016 @03:48PM (#13066142)
FYI: Default redis install has since fixed this vulnerability.
[ Parent | on HN ]